diff --git a/.env.example b/.env.example
index a755f73..07c1f9b 100644
--- a/.env.example
+++ b/.env.example
@@ -7,6 +7,7 @@ CRANK_ADMIN_API_IMAGE=crank/admin-api:dev
 CRANK_MCP_SERVER_IMAGE=crank/mcp-server:dev
 CRANK_UI_IMAGE=crank/ui:dev
 CRANK_STORAGE_ROOT=/var/lib/crank/storage
+CRANK_PUBLISH_BIND=127.0.0.1
 CRANK_ADMIN_BIND=0.0.0.0:3001
 CRANK_MCP_BIND=0.0.0.0:3002
 CRANK_MCP_REFRESH_MS=5000
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 5642fb7..7d8c270 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -125,6 +125,7 @@ jobs:
           POSTGRES_HOST: ${{ secrets.POSTGRES_HOST }}
           POSTGRES_PORT: ${{ secrets.POSTGRES_PORT }}
           CRANK_STORAGE_ROOT: ${{ secrets.CRANK_STORAGE_ROOT }}
+          CRANK_PUBLISH_BIND: ${{ secrets.CRANK_PUBLISH_BIND }}
           CRANK_ADMIN_BIND: ${{ secrets.CRANK_ADMIN_BIND }}
           CRANK_MCP_BIND: ${{ secrets.CRANK_MCP_BIND }}
           CRANK_MCP_REFRESH_MS: ${{ secrets.CRANK_MCP_REFRESH_MS }}
@@ -152,6 +153,7 @@ jobs:
           append_if_set POSTGRES_HOST "$POSTGRES_HOST"
           append_if_set POSTGRES_PORT "$POSTGRES_PORT"
           append_if_set CRANK_STORAGE_ROOT "$CRANK_STORAGE_ROOT"
+          append_if_set CRANK_PUBLISH_BIND "$CRANK_PUBLISH_BIND"
           append_if_set CRANK_ADMIN_BIND "$CRANK_ADMIN_BIND"
           append_if_set CRANK_MCP_BIND "$CRANK_MCP_BIND"
           append_if_set CRANK_MCP_REFRESH_MS "$CRANK_MCP_REFRESH_MS"
diff --git a/docker-compose.yml b/docker-compose.yml
index 9de452e..ffdc1a1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -46,7 +46,7 @@ services:
     volumes:
       - artifact_storage:${CRANK_STORAGE_ROOT:-/var/lib/crank/storage}
     ports:
-      - "127.0.0.1:3001:3001"
+      - "${CRANK_PUBLISH_BIND:-127.0.0.1}:3001:3001"
     healthcheck:
       test: ["CMD", "curl", "--fail", "http://127.0.0.1:3001/health"]
       interval: 15s
@@ -77,7 +77,7 @@ services:
     volumes:
       - artifact_storage:${CRANK_STORAGE_ROOT:-/var/lib/crank/storage}
     ports:
-      - "127.0.0.1:3002:3002"
+      - "${CRANK_PUBLISH_BIND:-127.0.0.1}:3002:3002"
     healthcheck:
       test: ["CMD", "curl", "--fail", "http://127.0.0.1:3002/health"]
       interval: 15s
@@ -91,7 +91,7 @@ services:
       dockerfile: apps/ui/Dockerfile
     restart: unless-stopped
     ports:
-      - "127.0.0.1:3000:3000"
+      - "${CRANK_PUBLISH_BIND:-127.0.0.1}:3000:3000"
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/"]
       interval: 15s
diff --git a/docs/deployment.md b/docs/deployment.md
index c275084..9eb1767 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -166,6 +166,7 @@ services:
 - использовать env vars вместо hardcoded config;
 - иметь persistent storage для БД и artifacts;
 - публиковать `ui`, `admin-api` и `mcp-server` на loopback по умолчанию;
+- позволять переопределить publish bind одним env для случаев, когда reverse proxy вынесен на отдельный хост;
 - не публиковать внутренние сервисы наружу без необходимости;
 - содержать healthchecks.
 
@@ -237,6 +238,7 @@ Workflow собирает `.env` на сервере из отдельных Git
 - `POSTGRES_USER`
 - `POSTGRES_PASSWORD`
 - `CRANK_STORAGE_ROOT`
+- `CRANK_PUBLISH_BIND`
 - `CRANK_ADMIN_BIND`
 - `CRANK_MCP_BIND`
 - `CRANK_MCP_REFRESH_MS`
diff --git a/docs/runtime-config.md b/docs/runtime-config.md
index 4aa1795..aa6e0cf 100644
--- a/docs/runtime-config.md
+++ b/docs/runtime-config.md
@@ -64,6 +64,7 @@ var/crank/
 - `CRANK_MCP_SERVER_IMAGE`
 - `CRANK_UI_IMAGE`
 - `CRANK_STORAGE_ROOT`
+- `CRANK_PUBLISH_BIND`
 - `CRANK_ADMIN_BIND`
 - `CRANK_MCP_BIND`
 - `CRANK_MCP_REFRESH_MS`